Vulnerability · Published Mar 30, 2026 · Assigned by GitHub_M
CVE-2026-31831Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint
High 8.7
In plain English
A high-severity security flaw in Tautulli from Tautulli. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)2.0%top 19.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.
Affected products (as reported)
Weakness: CWE-23 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/Tautulli/Tautulli/security/advisories/GHSA-xp55-2pf4-fv8m x_refsource_CONFIRM
- https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 x_refsource_MISC